|Publication number||US7116786 B2|
|Application number||US 09/950,130|
|Publication date||Oct 3, 2006|
|Filing date||Sep 10, 2001|
|Priority date||Sep 10, 2001|
|Also published as||US20030051158|
|Publication number||09950130, 950130, US 7116786 B2, US 7116786B2, US-B2-7116786, US7116786 B2, US7116786B2|
|Inventors||Bernerd R. McKibben, Erwin P. Comer, William Turner Scott|
|Original Assignee||Motorola, Inc.|
|Export Citation||BiBTeX, EndNote, RefMan|
|Patent Citations (8), Non-Patent Citations (4), Referenced by (6), Classifications (7), Legal Events (6)|
|External Links: USPTO, USPTO Assignment, Espacenet|
The present invention pertains to communication networks and more particularly to interception of secure data in these communication networks.
Generally, law enforcement agencies worldwide require that network operators provide the capability to deliver intercepted communications to the law agency free of any network induced or enabling coding or encryption (plain text). Present networks allow either end-to-end encryption and encoding transparently without the network's knowledge, or application of encoding or encryption directly within the network. Currently, end-to-end encryption and encoding are applied transparently to the network and not required to be removed by the network.
Recent advances in network design allow the network to set up and maintain end-to-end encryption for subscribers.
Since an operator assists the set up of a secure link with encryption, the operator is able to provide interception of such service in “plain text”, even if an interception order arrives after the secure session is established.
Therefore, what is needed is for the network operator to be able to decrypt or decode an ongoing secure communication where the encryption is applied by the end user.
The single drawing FIGURE is a block diagram of a method for decrypting a secure data communication in accordance with the present invention.
Referring to the drawing FIGURE, a methodology for interception of encrypted data in a communication network is shown. Encryption variables unique to a user end device or subscription are stored as part of the network's device or subscriber profile. In the case of a UMTS system, the mobile's IMEI or IMSI could be used as an encryption variable seed. However, a security specific variable could be added to the subscriber profile. Mobile user 12 is attempting to place a call or data transfer to another mobile user 14 through mobile access/service network 10. Mobile end user or device 12 transmits a session request along with a key transfer 41. Keys which are managed by the network in the session establishment as stored by the network for the duration of the secure communication. In UMTS for example, the CSCF assigned to the target can detect and store the keys used to establish the secure communication.
Since the mobile access/service network 10 has been marked to intercept mobile user 12, copies of target keys and subscription/equipment based encryption variables are sent 42 to decrypt function 20. Mobile access/service network 10 sets up a link between the called user 14 and as a result, the communication session is accepted by called party 14 and user 14 transfers 43 its key to mobile access/service network 10. This initial state of the secure communication session is stored so that the network 10 knows the starting point of the pseudo-random sequence used to create the ciphered text exchanged between mobile users 12 and 14. In the case of UMTS for example, the SGSN provides imperceptible intercept of user data. The initial intercepted data from the SGSN can be stored in the network in case an intercept order is not yet activated. If the intercept was activated prior to secure communication session establishment, the intercepted data is forwarded immediately to a network decrypt function 20 to synchronize the network decryption functions for the communication session.
Mobile access/service network 10 then transmits 44 copies of called party's 14 keys and subscription/equipment based encryption variables to decrypt function 20 for storage.
Next, the secure communication session is established 45 between calling party (end user) 12 and called party (end user) 14. Data then freely flows between end users 12 and 14.
As parties 12 and 14 begin the transfer of data, mobile access/service network 10 determines the initial condition of pseudo random (PN) code applied by user 12 and transfers this information 46 to decrypt function 20 for storage.
Since end user 12 has been selected as a user to be intercepted by a valid law enforcement agency, law agency collection function 30 next issues an intercept order 47 for activating the intercept of end user 12. The intercept activation order 47 is transmitted from law agency collection function 30 to mobile access/service network 10 so that the intercept may proceed.
If the intercept activation order 47 is transmitted to mobile access/service network 10 after the secure communication session has been established between users 12 and 14, network 10 transmits 48 the data volume which has occurred since the communication session has been established to decrypt function 20 in order to synchronize the network 10 to the users 12 pseudo random generator. Once the network 10 has been synchronized to the user 12 pseudo random generator, all the encrypted communication data between users 12 and 14 is intercepted by network 10. Then network 10 transmits 49 this encrypted data to decrypt function 20 for decryption. Next, decrypt function 20 determines the current state of the PN sequence used by users 12 and 14. Using the current PN sequence, the transmitted data is decrypted by decrypt function 20.
When data is decrypted it becomes “plain text”, that is readable and understandable by anyone. When decrypt function 20 is synchronized to the PN sequence of users 12 and 14, decrypted data or “plain text” data is produced by decrypt function 20. The “plain text” data is then transmitted 50 to the law agency collection function 30 for use by the appropriate law enforcement agency. Decrypt function may be contained within network 10 itself or located within the law agency requesting the information. Or in an intermediate network (not shown) between network 10 and law agency collection function 30.
In a case where intercept activation order 47 is in place prior to the establishment of the secure communication session between users 12 and 14, then network 10 is not required to transmit 48 the traffic volume since the secure communication has been established. Step 48 may be omitted since the call was begun after the intercept activation order 47 was in place within the network 10.
In an alternate embodiment, steps 48 and 46 may be omitted. In place of steps 46 and 48, the network 10 may transmit requests 61 and 62 to users 12 and 14 respectively to resynchronize their encryption of communication data. In this manner, intercept activation order 47 is already in place when the encrypted data is transmitted between end users 12 and 14. The decrypt function 20 may then easily detect the current state of the PN code used for data encryption by the users. This scenario places a further restriction on the end users in that they must resynchronize their encrypted communication upon command of the network 10.
Although the explanation of the present invention has been explained in the context of law enforcement intercept, the methodology may also be used for quality monitoring and a seamless security transition from a two-way session to a three-way session.
As can be seen from the above explanation, the present invention allows operators of networks to remove network provided end to end encryption of data communication.
Law enforcement agencies are able to maintain effective interception of data as communication networks migrate from 2 G and from 2.5 G to 3 G networks. Most importantly, this invention provides for the interception of end-to-end secure communication data and providing the equivalent plain text version to the appropriate authorized law enforcement agency.
Although the preferred embodiment of the invention has been illustrated, and that form described in detail, it will be readily apparent to those skilled in the art that various modifications may be made therein without departing from the spirit of the present invention or from the scope of the appended claims.
|Cited Patent||Filing date||Publication date||Applicant||Title|
|US5815573 *||Apr 10, 1996||Sep 29, 1998||International Business Machines Corporation||Cryptographic key recovery system|
|US5838792 *||Aug 8, 1996||Nov 17, 1998||Bell Atlantic Network Services, Inc.||Computer system for centralized session key distribution, privacy enhanced messaging and information distribution using a split private key public cryptosystem|
|US6122499 *||Jul 31, 1998||Sep 19, 2000||Iridium, L.L.C.||System and/or method for call intercept capability in a global mobile satellite communications system|
|US6654589 *||Sep 25, 1998||Nov 25, 2003||Nokia Networks Oy||Legal interception in a telecommunications network|
|US6711689 *||Sep 10, 2001||Mar 23, 2004||Nokia Corporation||Interception system and method|
|US6738902 *||Jan 14, 2000||May 18, 2004||Motorola, Inc.||Systems and methods for controlling authorized intercept|
|US6823185 *||Jun 19, 2000||Nov 23, 2004||Motorola, Inc.||Systems and methods for performing authorized intercept in a satellite-based communications system|
|US20010050990 *||Dec 27, 1999||Dec 13, 2001||Frank Wells Sudia||Method for initiating a stream-oriented encrypted communication|
|1||*||"EISI TS 133 106 V4.0.0 (Mar. 2001), Universal Mobile Telecommunications System (UMTS); 3G Security; Lawful Interception Requirements", Mar. 2001, European Telecommunications Standards Institute, Retrieved from the Internet on Jul. 24, 2006 <URL: http://eu.sabotage.org/www/ETSI<SUB>-</SUB>surveillance<SUB>-</SUB>standards/2001<SUB>-</SUB>03<SUB>-</SUB>ETSI<SUB>-</SUB>TS<SUB>-</SUB>133<SUB>-</SUB>106<SUB>-</SUB>v4.0.0<SUB>-</SUB>umts<SUB>-</SUB>requirements.pdf>.|
|2||*||ETSI TS 101 331 V1.1.1-Requirements of Law Enforcement Agencies, Aug. 2001, European Telecommunications Standards Institute, Retrieved from the Internet on Mar. 14, 2005 <URL: http://www.gliif.org/LI<SUB>-</SUB>standards/ts<SUB>-</SUB>101331v010101p<SUB>-</SUB>lea-requirements.pdf>.|
|3||*||ETSI TS 133 106 V4.0.0-Lawful Interception Requirements, Jan. 2000, European Telecom. Standards Institute, Retrieved from the Internet on Mar. 14, 2005 <URL: http://eu.sabotage.org/www/ETSI<SUB>-</SUB>surveillance<SUB>-</SUB>standards/2000<SUB>-</SUB>01<SUB>-</SUB>ETSI<SUB>-</SUB>TS<SUB>-</SUB>133<SUB>-</SUB>106%20V3.1.0<SUB>-</SUB>UMTS.pdf>.|
|4||*||Security Architecture-3G TS 33.102 version 3.1.0, Jul. 1999, 3<SUP>rd </SUP>Generation Partnership Project, Downloaded from the Internet on Mar. 14, 2005 <URL: http://www.3gpp.org/ftp/Specs/archive/33<SUB>-</SUB>series/33.102/>.|
|Citing Patent||Filing date||Publication date||Applicant||Title|
|US7296156 *||Jun 20, 2003||Nov 13, 2007||International Business Machines Corporation||System and method for SMS authentication|
|US7565146 *||Dec 21, 2001||Jul 21, 2009||Nokia Corporation||Intercepting a call connection to a mobile subscriber roaming in a visited PLMN (VPLMN)|
|US8213619 *||Jul 8, 2008||Jul 3, 2012||Samsung Electronics Co., Ltd.||Method and apparatus for establishing communication via service provider|
|US20040030906 *||Jun 20, 2003||Feb 12, 2004||International Business Machines Corporation||System and method for SMS authentication|
|US20050027866 *||Dec 21, 2001||Feb 3, 2005||Jorma Seurujarvi||Intercepting a call connection to a mobile subscriber roaming in a visted plmn (vplmn)|
|US20090154706 *||Jul 8, 2008||Jun 18, 2009||Samsung Electronics Co., Ltd.||Method and apparatus for establishing communication via service provider|
|U.S. Classification||380/286, 380/270, 380/247|
|International Classification||H04L9/00, H04K1/00|
|Sep 10, 2001||AS||Assignment|
Owner name: MOTOROLA, INC., ILLINOIS
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:MCKIBBEN, BERNERD R.;COMER, ERWIN P.;SCOTT, WILLIAM TURNER;REEL/FRAME:012168/0732
Effective date: 20010907
|Mar 23, 2010||FPAY||Fee payment|
Year of fee payment: 4
|Dec 13, 2010||AS||Assignment|
Owner name: MOTOROLA MOBILITY, INC, ILLINOIS
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:MOTOROLA, INC;REEL/FRAME:025673/0558
Effective date: 20100731
|Oct 2, 2012||AS||Assignment|
Owner name: MOTOROLA MOBILITY LLC, ILLINOIS
Free format text: CHANGE OF NAME;ASSIGNOR:MOTOROLA MOBILITY, INC.;REEL/FRAME:029216/0282
Effective date: 20120622
|Mar 26, 2014||FPAY||Fee payment|
Year of fee payment: 8
|Nov 26, 2014||AS||Assignment|
Owner name: GOOGLE TECHNOLOGY HOLDINGS LLC, CALIFORNIA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:MOTOROLA MOBILITY LLC;REEL/FRAME:034475/0001
Effective date: 20141028